The code is gratis. Although, partnership deals tend to go beyond simply sharing code, and into the realm of dedicating time and resources to working with each other.

I think this is why this doesn't shock (shock!) me.

We're talking about a curated, supported, official image here, right?

If folks want to use a "MyUbuntuImage" they or someone else packaged and uploaded, more power to them.

But by pulling a Canonical image, you have a relationship with Canonical. Expecting that relationship not to exist "because open source" seems to be misunderstanding who does what work.

As to whether this should be opt-in, done, etc. is another matter entirely. But the fact that it exists at all doesn't feel particular shocking.

It's not like we're talking about everyone who pulls a RedHat image's info being sent to Canonical!

The code is more than just gratis; it's libre. This is Ubuntu, based on Debian GNU/Linux. (Yeah, okay, some of the code is merely gratis, but most of it is libre.)

I don't expect an OS based on an OS based on an OS based on a half-finished OS based on free software principles to have shady data-dealing attached, yet hidden from the people whose data is being dealt.

My point is that it's not about the code at all.

You might not have expected it, but privacy protection is not any sort of obligation encoded in any extant concept of Free Software.

Free software is about user empowerment, and the ability for users to be hackers if they want to (or employ people to make changes on their behalf). “Sike, we've been stalking you and you can't do anything about it” is antithetical to this ideal.

Privacy protection is not an obligation, but transparency and openness is. Yes, you're not contractually required to not make a separate computer system that's proprietary and closed and disempowering, but that's so pedantic as to be malicious.

It has nothing to do with Free Software. I'd expect the same treatment if I were paying Microsoft to run Oracle for me.

So you didn't read the ToS, I take it? I did. I do whenever it's something important to the company's infrastructure. Canonical is the one at fault here for not adhering to Microsoft's guidelines. But Microsoft put the warning on the package.

I mean, it's kind of ridiculous to think that you could do anything in a cloud environment system and not have your actions tracked. Hell, with automated load balancing and load-based billing, that's literally what you're signing up for.

another vector here is the WSL

I wouldn't be surprised to learn Azure was paid (either money or developer time) and this is happening for other products. I would think twice before using Azure if I was concerned about my usage being shared.

It is. For example I've warned others about the eula shipped with Dell systems with Linux (Ubuntu) on them for similar reasons... and encourage people to do their own installion of images (containerized or otherwise).